From Speech Tokens to Stolen Voices: Attacker-Chosen-Text Speaker Impersonation via Representation Inversion

Ye Lu; Shen Wang; Runze Liu; Zhitao Ou; Haonan Huang; Yihan Yan; Fanghui Sun; Zhaoyang Zhang

cs.SDOct 26, 2026

From Speech Tokens to Stolen Voices: Attacker-Chosen-Text Speaker Impersonation via Representation Inversion

Authors: Ye Lu, Shen Wang, Runze Liu, Zhitao Ou, Haonan Huang, Yihan Yan, Fanghui Sun, Zhaoyang Zhang

Organizations: School of Cyberspace Science, Harbin Institute of Technology

Abstract

Speech interaction systems have gradually evolved from traditional cascaded systems that use text as intermediate information to end-to-end speech language models that directly process speech representations. In some applications, the speech frontend runs on the user's device and sends speech representations to a remote server for inference, while the original audio remains local. However, these representations may still contain speaker identity information. If an attacker obtains them, it may use this information to imitate the user's voice, threatening their voice privacy. To investigate this risk, we propose \stia, a Speech Token Inversion Attack that generates speech with attacker-specified text in a victim's voice using a single short leaked representation, without access to the original audio or its transcript. Specifically, \stia converts discrete, continuous, or mixed speech representations into conditioning sequences and trains a conditional flow-matching speech generation model using pairs of different utterances from the same speaker in public speech datasets. The model combines speaker characteristics contained in the leaked representation with the specified text to generate speech in the victim's voice. Experiments show that, with a Moshi representation leak corresponding to 3 seconds of speech, \stia achieves an average CAM++ speaker cosine similarity of 0.78 and a target-text word error rate of 3.80%. These results show that speech frontend representations reveal reusable speaker identity information and highlight the need to consider privacy risks when designing speech frontend representation methods.

Figures & tables

Fig. 1: Split-deployment setting and STIA attack overview. The attacker combines leaked frontend representations with chosen text to generate speech; the boxes on the right state the attack objectives.

Fig. 2: Overview of STIA . (a) Cross-utterance training with flow-matching, codec, and stopping losses. (b) Generation from leaked representations and chosen text via Euler sampling and codec decoding.

Target model	Frontend model	Frontend processing pipeline	Frontend output format	Output dimension
Moshi	Mimi neural audio codec	24-kHz mono waveform $\rightarrow$ causal SEANet encoder (strides $4,5,6,8,2$ ) $\rightarrow$ 8-layer, 8-head Transformer $\rightarrow$ 8-stage split RVQ	Frame-synchronous discrete RVQ code-index streams at 12.50 Hz	8 scalar IDs/frame; 2,048 entries per stage
Kimi-Audio	GLM-4-Voice semantic tokenizer and adapted Whisper encoder	16-kHz mono waveform $\rightarrow$ 128-bin log-Mel features $\rightarrow$ parallel semantic and acoustic branches: 32-layer tokenizer with single-codebook VQ; four 1,280-D Whisper frames with a 2-layer adaptor	Aligned semantic ID and continuous acoustic feature at 12.50 Hz	1 scalar ID $+$ 3,584-D vector/frame
Qwen3-Omni	Audio Transformer (AuT) encoder	16-kHz mono waveform $\rightarrow$ 128-bin log-Mel features (25-ms window, 10-ms hop) $\rightarrow$ three stride-2 Conv2D blocks $\rightarrow$ 32-layer, 650M-parameter AuT (width 1,280)	Frame-synchronous continuous AuT hidden sequence at 12.50 Hz	2,048-D vector/frame

TABLE I: Audio frontend architectures, processing pipelines, output formats, and representation dimensions of Moshi, Kimi-Audio, and Qwen3-Omni at the input-side interfaces evaluated in the split-deployment attack setting.

Target model	Attack	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
Moshi	SpInv+TTS	$0.22\pm 0.11$	$0.26\pm 0.10$	$13.37\pm 44.99$	$2.91\pm 0.65$
Moshi	STIA (ours)	${\mathbf{0.78}\pm 0.03}_{(\uparrow\,0.56)}$	${\mathbf{0.79}\pm 0.05}_{(\uparrow\,0.53)}$	${\mathbf{3.80}\pm 12.60}_{(\downarrow\,\underline{9.57})}$	${\mathbf{2.92}\pm 0.17}_{(\uparrow\,0.01)}$
Kimi-Audio	SpInv+TTS	$0.13\pm 0.12$	$0.20\pm 0.12$	$12.40\pm 32.40$	$2.87\pm 0.52$
Kimi-Audio	STIA (ours)	${\mathbf{0.82}\pm 0.03}_{(\uparrow\,\underline{0.69})}$	${\mathbf{0.85}\pm 0.05}_{(\uparrow\,\underline{0.65})}$	${\mathbf{3.84}\pm 11.25}_{(\downarrow\,8.55)}$	${\mathbf{2.97}\pm 0.22}_{(\uparrow\,\underline{0.10})}$
Qwen3-Omni	SpInv+TTS	$0.35\pm 0.09$	$0.33\pm 0.10$	$10.56\pm 26.27$	$2.91\pm 0.37$
Qwen3-Omni	STIA (ours)	${\mathbf{0.75}\pm 0.04}_{(\uparrow\,0.40)}$	${\mathbf{0.78}\pm 0.06}_{(\uparrow\,0.45)}$	${\mathbf{4.61}\pm 13.70}_{(\downarrow\,5.95)}$	${\mathbf{2.91}\pm 0.21}_{(\uparrow\,<0.01)}$

TABLE II: Comparison of STIA and SpInv+TTS on unseen Emilia speakers across three speech frontends, using identical 3-second representation leaks and attacker-chosen English prompts.

Language	CAM $\uparrow$	ECAPA $\uparrow$	WER/CER(%) $\downarrow$	UTMOS $\uparrow$
English	0.78	0.79	3.80	2.92
Chinese	${\mathbf{0.82}}_{(\uparrow\,0.04)}$	${\mathbf{0.84}}_{(\uparrow\,0.05)}$	${4.05}_{(\uparrow\,0.25)}$	${2.62}_{(\downarrow\,0.30)}$

TABLE III: Separate English and Chinese evaluations of STIA with language-specific training on Moshi.

Clips(M)	Dura.(h)	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
0.80	2.9k	0.70	0.76	8.98	2.93
1.60	5.9k	${0.76}_{(\uparrow\,0.06)}$	${0.78}_{(\uparrow\,0.03)}$	${5.19}_{(\downarrow\,3.78)}$	${2.92}_{(\downarrow\,<0.01)}$
2.40	8.9k	${\mathbf{0.78}}_{(\uparrow\,0.08)}$	${\mathbf{0.79}}_{(\uparrow\,0.03)}$	${\mathbf{3.80}}_{(\downarrow\,5.17)}$	${2.92}_{(\downarrow\,<0.01)}$

TABLE IV: Effect of auxiliary Emilia-English data budgets on STIA speech generation using the Moshi frontend.

Leakage	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
2.00 s	0.76	0.79	6.24	2.91
3.00 s	${0.78}_{(\uparrow\,0.03)}$	${0.79}_{(\uparrow\,<0.01)}$	${\mathbf{3.80}}_{(\downarrow\,2.44)}$	${\mathbf{2.92}}_{(\uparrow\,0.01)}$
5.00 s	${0.79}_{(\uparrow\,0.03)}$	${0.81}_{(\uparrow\,0.03)}$	${3.85}_{(\downarrow\,2.38)}$	${2.90}_{(\downarrow\,<0.01)}$
8.00 s	${\mathbf{0.80}}_{(\uparrow\,0.04)}$	${\mathbf{0.82}}_{(\uparrow\,0.03)}$	${3.95}_{(\downarrow\,2.29)}$	${2.90}_{(\downarrow\,<0.01)}$

TABLE V: Effect of leaked representation duration on STIA speech generation using the Moshi frontend.

Size	Params	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
XL	0.60B	0.78	0.79	3.80	2.92
L	0.50B	${0.75}_{(\downarrow\,0.03)}$	${0.77}_{(\downarrow\,0.02)}$	${4.71}_{(\uparrow\,0.91)}$	${2.82}_{(\downarrow\,0.10)}$
M	0.35B	${0.70}_{(\downarrow\,0.08)}$	${0.72}_{(\downarrow\,0.07)}$	${7.72}_{(\uparrow\,3.92)}$	${2.59}_{(\downarrow\,0.33)}$

TABLE VI: Effect of STIA model size on speech generation from 3-second Moshi representation leaks.

Input	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
Original	0.78	0.79	3.80	2.92
Anonymized	${0.44}_{(\downarrow\,0.35)}$	${0.43}_{(\downarrow\,0.36)}$	${4.51}_{(\uparrow\,0.71)}$	${2.43}_{(\downarrow\,0.49)}$

TABLE VII: Effect of McAdams input anonymization on a fixed STIA attacker using the Moshi frontend.

Control	CAM $\uparrow$	ECAPA $\uparrow$	WER (%) $\downarrow$	UTMOS $\uparrow$
Standard	0.78	0.79	3.80	2.92
- No-leak	${0.25}_{(\downarrow\,0.54)}$	${0.25}_{(\downarrow\,0.54)}$	${12.94}_{(\uparrow\,9.14)}$	${2.47}_{(\downarrow\,0.44)}$
- No-text	${0.57}_{(\downarrow\,0.21)}$	${0.48}_{(\downarrow\,0.31)}$	—	${2.49}_{(\downarrow\,0.43)}$
- Neither	${0.22}_{(\downarrow\,0.57)}$	${0.26}_{(\downarrow\,0.53)}$	—	${2.49}_{(\downarrow\,0.43)}$
- Wrong text	${0.75}_{(\downarrow\,0.04)}$	${0.71}_{(\downarrow\,0.08)}$	${99.17}_{(\uparrow\,95.37)}$	${\mathbf{3.08}}_{(\uparrow\,0.16)}$

TABLE VIII: Leakage-conditioning and target-text controls for STIA speech generation using the Moshi frontend.

Setting	Value
Optimizer / precision	AdamW / BF16
Effective batch size	64
Training steps	150,000
Peak / final learning rate	$2.00\times 10^{-4}$ / $2.00\times 10^{-5}$
Warmup / schedule	1,000 steps / cosine decay
Main leak / model	3.00 s / XL (0.60B)

TABLE IX: Training and sampling configuration of STIA and main-model training cost on the Moshi frontend.

Voice Cloning

Voice cloning uses speech samples to reproduce a speaker’s vocal identity in generated speech across different content, languages, and styles.

See all 42 papers

Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models
Jul 18, 2026Ye Lu, Yihan Yan, Zhaoyang Zhang +4Adversarial Attacks Privacy Leakage in Language Models
School of Cyberspace Science, Harbin Institute of Technology, Harbin 150001, China
Speech Generation Speaker Poisoning: Capability Erasure in Zero-Shot Text-to-Speech
Mar 8, 2026Thanathai Lertpetchpun, Thanapat Trachu, Sai Praneeth Karimireddy +1TTS Synthesis Zero-Shot TTS
Signal Analysis and Interpretation Laboratory, University of Southern California · Thomas Lord Department of Computer Science, University of Southern California
Privacy-Preserving End-to-End Full-Duplex Speech Dialogue Models
Mar 9, 2026Nikita Kuzmin, Tao Zhong, Jiajun Deng +6Privacy-Preserving Speech Processing Speaker Anonymization
Nanyang Technological University, Singapore · A*STAR, Singapore · Huawei Leibniz Research Center +2

Jul 18, 2026J/K move · Enter open · S save

Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models

Ye Lu, Yihan Yan, Zhaoyang Zhang, Zhitao Ou+3

School of Cyberspace Science, Harbin Institute of Technology, Harbin 150001, China

Adversarial Attacks Privacy Leakage in Language Models Audio Tokenization Speech Language Models

Open paper AskPDF arXiv

End-to-end speech language models increasingly represent user speech with speech tokens rather than relying exclusively on cascaded ASR--LLM--TTS pipelines. Although these tokens support expressive and low-latency spoken interaction, they may also preserve sensitive speaker characteristics. We investigate whether exposed speech tokens leak voiceprints and formulate this risk as a speaker inversion attack. We introduce Audio BERT (AuB), a trainable model that constructs token embeddings from discrete codebooks and aggregates them into speaker-sensitive representations, and propose SpInv, a two-stage inversion method built on AuB to recover embeddings in the space of an attacker-specified speaker encoder. We evaluate Moshi, Higgs3, Kimi-Audio, and Qwen3-Omni using speaker-disjoint protocols on the VoxCeleb dataset. Extensive experiments show that, with only three seconds of frontend output, SpInv achieves cosine similarities above 0.70 in the attacker-specified speaker-encoder space.

Abstract

Voice Cloning

Explore similar work

Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models

Speech Generation Speaker Poisoning: Capability Erasure in Zero-Shot Text-to-Speech

Privacy-Preserving End-to-End Full-Duplex Speech Dialogue Models